+49 7541 70078-776
Security and Privacy at Secure Password Share
End-to-End Encryption in the Browser
With Secure Password Share, you can exchange passwords in compliance with the GDPR. Encryption and decryption take place exclusively within the browser. The SPS servers do not receive your passwords in plain text and cannot read them. Secure Password Share does not store the secret key required for decryption.
The Enterprise version runs within your Azure subscription. You can share password links specifically with certain individuals within your organization.
- GDPR-compliant
- End-to-end encryption locally in the browser
- No storage of the secrets entered
- 2-factor authentication
- Maximum data sovereignty with the Enterprise version
- One one-time link per recipient
- Maximum data sovereignty in the Enterprise Version thanks to a dedicated instance in the corporate tenant
Deletion of Content and Account Data
- Encrypted content:
This content is removed from the active database after it has been accessed once, deactivated early, or the link has expired without being used.
Depending on your selection, a link is valid for up to two weeks.
- Link History:
Entries for password links are deleted three months after they expire; entries for guest access links are deleted after six months.
You can delete entries yourself at any time.
- Account Information:
When you delete your account, the account, settings, notifications, and all links you have created—including active links—will be immediately deleted from the active database.
The timeframes described below apply to database backups.
Logs and Backups
Technical server logs are retained for 30 days. Error reports are stored on a separate doubleSlash server and are deleted after 60 days.
The database is backed up every four hours. Only the two most recent backups are retained. With this backup configuration, content that has been retrieved may remain encrypted in a backup for up to eight hours during regular database operations. It cannot be read without the corresponding secret key.
The same default settings apply to Enterprise. The data is stored in your company’s Azure subscription.
Information security at doubleSlash
Secure Password Share is a product of doubleSlash Net-Business GmbH. As an IT service provider in Germany, we attach great importance to the security and protection of your data. Comprehensive security protocols for our services and products guarantee the integrity and confidentiality of your data. To this end, we regularly obtain meaningful certificates that attest to our commitment to information security.
doubleSlash is a certified IT service provider
doubleSlash is certified according to the international standards ISO 27001 and TISAX, which underlines our commitment to information security and data protection at the highest level. These certifications ensure that we have implemented strict security measures that are regularly reviewed and further developed.
Hosting and Data Residency
Lite:
The application, database, and technical server logs are hosted on Microsoft Azure in West Europe (Netherlands). Azure also mirrors the database backups to North Europe (Ireland). Sign-in is handled via the doubleSlash sign-in service Azure AD B2C with the EU data region. When signing in via Google, GitHub, LinkedIn, or a personal Microsoft account, you also use the respective provider.
Enterprise:
The application, database, and technical server logs are located in your Azure subscription, in the region selected during Marketplace installation. The region for database backups depends on the backup configuration; with geo-redundancy, backups are additionally replicated to a partner region. You log in using your own Microsoft Entra ID.
